Zheng Wang 715c0200b4 media: mtk-jpeg: Fix use after free bug due to uncanceled work ... [ Upstream commit c677d7ae83 ] In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run and mtk_jpeg_enc_device_run may be called to start the work. If we remove the module which will call mtk_jpeg_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. Fix it by canceling the work before cleanup in the mtk_jpeg_remove CPU0 CPU1 |mtk_jpeg_job_timeout_work mtk_jpeg_remove | v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use Fixes: b2f0d2724b ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com> Reviewed-by: Chen-Yu Tsai <wenst@chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-09-13 09:42:50 +02:00
..
cec	media: pulse8-cec: handle possible ping error	2023-09-13 09:42:20 +02:00
common	…
dvb-core	media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221	2023-06-09 10:34:13 +02:00
dvb-frontends	media: cx24120: Add retval check for cx24120_message_send()	2023-09-13 09:42:50 +02:00
firewire	…
i2c	media: i2c: tvp5150: check return value of devm_kasprintf()	2023-09-13 09:42:49 +02:00
mc	…
mmc	…
pci	media: pci: cx23885: fix error handling for cx23885 ATSC boards	2023-09-13 09:42:21 +02:00
platform	media: mtk-jpeg: Fix use after free bug due to uncanceled work	2023-09-13 09:42:50 +02:00
radio	media: radio-shark: Add endpoint checks	2023-05-30 14:03:20 +01:00
rc	media: rc: gpio-ir-recv: Fix support for wake-up	2023-05-11 23:03:15 +09:00
spi	…
test-drivers	…
tuners	…
usb	media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()	2023-09-13 09:42:50 +02:00
v4l2-core	media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()	2023-09-13 09:42:49 +02:00
Kconfig	…
Makefile	…